Security Audit & Enhancement for Wromble.dk

@a4logic

Hello, As a seasoned developer with more than 15 years in the field, I have gained extensive experience that aligns perfectly with your project. My specialization in PHP, MySQL, Stripe and mobile app security uniquely positions me to undertake this important venture of conducting a thorough security audit and remediation for Wromble.dk. Over my career, I've successfully executed various security audits and remediation operations across multiple platforms, using my comprehensive knowledge of web application vulnerabilities and OWASP Top 10 issues. Not only that, I have an in-depth understanding of the unique security challenges faced by mobile applications which is essential since your project requires verifying the iOS/Android apps. By choosing me for this project, you are guaranteed unmatched dedication to quality, timeliness, and concise communication. My objective is to deliver a comprehensive, professional written security report alongside successful eradication of any remaining security vulnerabilities. I also understand the importance of signing the Security Completion & Acceptance document; you have my 100% commitment to adhere to all contractual terms. Thanks!

@starttechno

The 49-item audit and the already-applied fixes give me a clear starting point: I’ll replay every finding against the current PHP/MySQL and Stripe implementation, especially SQL injection, payment bypass, chat and invoice IDOR, stored XSS, session/CORS issues, bcrypt migration, and consolidated secrets—verifying exploitability and authorization boundaries rather than accepting code changes at face value. I’ll build the iOS and Android sources, compare behavior and configuration with the App Store and Google Play versions, provide test links, rotate exposed keys where needed, and deliver a finding-by-finding security report with the signed Security Completion & Acceptance document. The full verification, remediation, mobile builds, and written deliverables will be completed in 7 days after source and access are provided. Can you provide the previous 49-finding report and repository/build access at the start? Muhammad Saad

@DeveloperStation

Hi, Verifying another developer's security fixes needs a clean baseline, not just a re-scan. I'd re-test each of the 49 findings against the original report first, since a "fixed" SQL injection or IDOR often just moves to an adjacent endpoint. One question: do you have the previous auditor's findings list plus current source access for web, backend, and both apps, or only the summary? For the mobile side, building from source and diffing against the App Store and Play Store binaries is the only way to confirm the shipped apps match. Rotating Stripe and DB keys after that. I've worked heavily in PHP, MySQL, and Stripe payment flows, and web security is core to what I do. Send the report and repo access and I'll map each finding to a verify or fix status. Adil

@ravichedwal

Hi, Since 49 vulnerabilities were previously identified and major fixes have already been implemented, the priority now is independent verification—not assuming that closing the original SQLi, payment bypass, XSS, IDOR, authentication, CORS, and credential issues actually removed the attack paths. I’m a senior Full-Stack Developer with 10+ years of experience in PHP/MySQL, APIs, Stripe, authentication, RBAC, secure application architecture, and iOS/Android-backed systems. I’ve worked on platforms involving payments, sensitive user data, subscriptions, access controls, and large production databases. I’ll work against the original 49-findings report, reproduce/retest each issue, review the implemented patches, test OWASP Top 10 attack surfaces, Stripe/payment flows, sessions, authorization/IDOR, APIs and exposed secrets. I’ll also build both mobile apps from source, validate backend/API behaviour, provide test builds, and document remaining risks/remediation. Deliverables include a finding-by-finding verification matrix, fixes, regression testing, secret/key rotation where required, mobile build verification, and final security report. I’m comfortable reviewing and signing your contract/acceptance document before work begins. Estimated time: 3–4 weeks Fixed price: $5,000 Please share the original audit report, source repositories, and contract so I can confirm the complete scope before kickoff. Best, Aminesh

@crtvecode

When a platform has multiple security vulnerabilties across its website and mobile apps, the underlying issue often lies in a lack of thorough verification and consistant security practices. I understand your concern about making sure that all previous fixs are valid and that no new vulnerabilities emerge during this process. My approach will focus on a structured verification process to safeguard your platform without disrupting the current user experience. Verification phase: Confirm all reported vulnerabilities are fixed and perform additional testing. Remediation phase: Identify and address any remaining vulnerabilities in the system. Mobile testing phase: Build and test iOS and Android apps from source code against live versions. Documentation phase: Deliver a full security report and complete acceptance document. To tailor my approach effectively, could you clarify if there are any specific compliance requirements or industry standards you need to adhere to? Thanks, Rajavel

@marjanahmed13

Hi! My name is Marjan and I'm here to offer you my services as a skilled applicant with over a decade of experience working on Freelancer.com. I believe I am the best fit candidate for this project due to my extensive experience; I would like to have a discussion to get to know that we both are on the same page. Once the scope will be locked, I will start working on it right away.

@geologistt

I have strong experience with PHP, MySQL, and Stripe integrations, along with hands-on work applying the OWASP Top 10 to real-world audits including SQL injection, IDOR, stored XSS, session/cookie security, CORS misconfigurations, and payment logic flaws, all of which appear in your findings list. I also have experience building and testing iOS/Android apps from source to compare against published App Store/Play Store builds. My approach: Independent verification — Re-test all 49 original findings against the current codebase to confirm each fix is correctly and completely implemented (not just superficially patched). Gap analysis — Identify any remaining or newly introduced vulnerabilities across web, backend, and mobile. Mobile build testing — Build iOS/Android from source, diff behavior against live store versions, and provide test links. Key/secret rotation — Rotate any credentials flagged as previously exposed (DB, Stripe, session secrets). Deliverables — Full written security report + signed Security Completion & Acceptance document. I'm comfortable signing your contract and terms before starting, and will provide a full project scope and fixed price once I've had a chance to review the original audit report and current codebase Happy to start with a short call or async review of the audit doc to firm up numbers within 24–48 hours.

@krupnovdenis

Hello! We can help verify and complete the security work on your platform. 1. Which issues should we verify and fix first? 2. Do you need the audit report and acceptance document as part of delivery? — About us We are dZENcode – a full-cycle IT company for digital product development: from design and programming to integrations and post-release support. We build projects from scratch and also work on existing solutions that need further development, improvements, or technical support. You can find detailed information about our services and rates on our official website: https://dzencode.com. Please review it – after that, we can discuss the details and agree on the next step. ⚠️ After clarifying all details, we will define the scope, the suitable cooperation format – task-based, outsourcing, or outstaffing – and the final cost. Projects are guaranteed to reach release with us: • 10+ years providing IT services; • 90+ in-house specialists; • 250+ public reviews since 2015; • We support products under SLA after launch; • We work under NDA and a company contract!

@denisSolution

Hi, I'm Denis, a full-stack developer specializing in security auditing and remediation for web and mobile platforms. I've handled vulnerability verification, OWASP compliance, and payment system security on similar projects. I understand your need: independent verification of audit fixes, confirmation of no remaining gaps, and assurance your mobile builds match production versions. This is critical work—missed vulnerabilities in payment processing or access control have serious consequences. I've verified SQL injection patches, reviewed session management and CORS configurations, tested authentication flows across platforms, and managed key rotation during remediation. My approach: I'll review the audit report and existing fixes, then systematically test each vulnerability category against the current codebase, focusing on payment processing, data access controls, and authentication. For mobile apps, I'll build from source and compare binaries with App Store and Play Store versions. I'll identify remaining issues, fix them, and provide comprehensive documentation including key rotation before sign-off. The main technical consideration is ensuring patches are truly effective, not surface-level. SQL injection fixes need verification at every query point, and access control issues often have similar patterns elsewhere. I'll mitigate scope risks through thorough code review alongside testing to catch systemic issues early. Based on the scope described, I estimate 80-120 ho

@bcosley

Hi, The goal is to verify fixes across the web app and mobile clients, surfacing any gaps before production. I’ve validated PHP/MySQL stacks with Stripe and tested iOS/Android builds from source. Execution approach: I’ll reproduce issues in staging, map fixes, and run targeted tests for OWASP Top 10, session handling, and CORS. I’ll build the iOS and Android apps from source and document results. One risk is that fixes reveal themselves only under production-like traffic; a controlled test window helps. What data should we use for verification: anonymized production data or synthetic data? Who signs off on the Security Completion & Acceptance document, and where should the final report be stored? If we're aligned, I’d be happy to walk you through the implementation plan before we get started. Best regards, Brandon

@Tanmoy236

Hi There! I specialize in security-focused PHP/MySQL reviews where previously reported vulnerabilities need independent verification, not just another checklist audit. With 9+ years of experience, 450+ completed projects, Top 1% verified freelancer, I can review the 49 findings and verify fixes across SQL injection, IDOR, XSS, auth/session controls, Stripe/payment flows, CORS and OWASP risks. I’ll also assess the iOS/Android builds against the store versions, test remaining attack surfaces, rotate exposed secrets where required, and provide the requested security report and completion documentation. I can provide a fixed price and realistic timeline after reviewing the existing audit and source. Can you share the previous 49-finding security report and current source so I can scope the verification accurately?

@pinesucceed01

Hello, With regard to your project, I have a long-standing commitment to maintain high-level security standards. In my 16 years as a developer, I have consistently stayed updated on the latest security threat vectors and mitigation strategies. Consequently, I can leverage this wealth of experience to independently verify all the fixes implemented on Wromble.dk. Dealing with critical and high-severity vulnerabilities such as SQL injection, XSS, and others have been a frequent task for me over the years, so it is something I am very well-equipped to address for your website, backend, iOS app, and Android app. For mobile app security testing, specifically the iOS and Android versions, I usually build them from source code to ensure they are in line with the versions on App Store and Google Play. Moving forward, I propose rotating relevant keys/secrets to minimize potential threat vectors completely. Additionally, my strong grasp of PHP, MySQL, Stripe and my sound understanding of OWASP's Top 10 Security Threats would certainly enable us to conduct a thorough security audit of your system. Lastly, rest assured that not only will I provide a full written security report and sign the acceptance document; but also guarantee a meticulously-detailed project description with fixed pricing before commencing any work. My past clients have consistently recommended me because of my reliability and seamless functionality. Giving your project to m Thanks!

@FizzaNadeemK

Hi, Could you share more details about the specific vulnerabilities you’d like me to focus on during the verification process? I noticed you’ve already had significant fixes implemented. With over 5 years of experience in PHP, MySQL, and mobile app security, including thorough familiarity with the OWASP Top 10, I can efficiently verify and remediate any remaining security issues on your platform. I’ve successfully completed similar audits, ensuring that all critical vulnerabilities are addressed and providing comprehensive security reports. I propose to complete the audit and testing in about 2-3 weeks for a fixed price of $1200. This includes all necessary testing for both iOS and Android apps and documentation. Looking forward to discussing this project further! Best Regards, fizza

@toriquldev123

Hello There! I’m Md Toriqul Islam, and I have 10+ years of experience in PHP, MySQL, Stripe integrations, OWASP security, secure APIs, and iOS/Android application development and testing. I have some questions: 1) Can you provide the previous 49-finding security audit and the remediation changelog? 2. Can I build the iOS/Android apps locally from the provided source and access the current store versions for comparison? 3. Which hosting/server environment, CI/CD, and secret-management systems are currently in use? I understand this requires independent verification of every reported vulnerability, additional security testing, remediation, mobile app comparison, key rotation, and a complete written security report with acceptance documentation. I am skilled in PHP, MySQL, Stripe, OWASP Top 10, API security, authentication, IDOR, XSS, SQL injection, iOS, Android, secure coding, penetration testing, and remediation. Estimated time: 7–10 days. Fixed price: $250 for the complete scope, subject to reviewing the existing audit and codebase. Looking forward to hearing from you. Best regards, Md Toriqul Islam

@AndrewJSMAN

I've audited PHP/MySQL apps with Stripe integrations and mobile apps before, so this is right in my wheelhouse. I'll verify all fixes, rebuild the iOS/Android apps from source, compare them to store versions, and test for new vulnerabilities. I'll also rotate keys, generate a full report, and sign the acceptance doc. I'll start immediately. Thanks, Andrii.

@mughiraaa

hi, i have reviewed the details of your project. i have strong experience with php, mysql, stripe and web application security, including owasp based security reviews, access control, idor, injection, xss, authentication and payment related issues. i can independently verify the previous 49 findings rather than simply assuming the reported fixes are correct, then identify and remediate anything still open. i can also build the ios and android apps from source, compare the builds against the store versions, review the security sensitive areas, rotate exposed secrets where required and provide a clear written report with evidence and remediation status. before starting, i can provide the complete project plan, estimated timeline and fixed price as requested, and i’m comfortable signing the provided contract and completion document. can we jump on a quick meeting to review the existing audit and source code, then i can finalize the fixed price and timeline?

@thomasb726

Hello, Most likely risk: remaining vulnerabilities stem from insecure session handling, API key exposure in mobile builds, and SQL injection patterns in legacy PHP endpoints that escaped initial fixes. I have 12+ years securing PHP/MySQL platforms and performing mobile app binary/source parity checks. Relevant work includes a payroll API and a mission-critical tax filing system where I verified OWASP Top 10 remediations, rotated secrets, and delivered signed security acceptance documents. I will verify your reported fixes, run targeted OWASP Top 10 tests, perform static and dynamic analysis of the iOS and Android codebases, build both apps from source and compare binaries with store builds, and validate Stripe integration and key management. My first step will be a quick 48-hour triage: run automated scans, confirm reported fixes, and identify high-impact gaps to produce a fixed-scope remediation list. - Your relevant experience I have delivered full security audits, secret rotations, mobile build comparisons, and completed signed Security Completion & Acceptance documents for web and mobile systems; experience covers PHP, MySQL, Stripe, OWASP Top 10, iOS/Android build/security testing. - Estimated time Triage and report: 2 days. Full audit, fixes verification, mobile build comparisons, remediation and final report: 8–12 business days depending on fixes needed. - Fixed price for the entire project USD 8,500 for the full audit, verification, mobile builds, secret rotation guidance, and final Security Completion & Acceptance document. Contract and terms accepted prior to start. - Do you have CI/CD access and provisioning credentials for app builds, or should I request build artifacts and App Store/Play Store listings? - Are there scheduled windows for production testing and secret rotations, or should I propose times after initial triage? Feel free to reach out if you want to talk through next steps. Thomas Beigbeder

@atifuiux

Hi, I can independently verify the existing security fixes and perform a complete security review across the PHP/MySQL backend, Stripe/payment flows, and iOS/Android applications. I’ll retest the reported vulnerabilities against OWASP practices, review authentication/access control, SQLi/XSS/IDOR, sessions, CORS, secrets and payment security, then document any remaining issues and remediation. I can also build the mobile apps from source and verify their security-related behavior. I can provide a final fixed price after reviewing the existing 49-finding audit report, source code, and contract so the complete scope is accurately covered. Best regards, Muhammad Atif LA

@Prutheus

A previous audit found 49 issues, another developer fixed many of the critical and high ones, and you need independent verification plus completion. Verification is the valuable part here, because a fix that looks applied is not the same as a fix that holds. How I would work: - Each finding re-tested against the live behaviour rather than read in the diff, particularly SQL injection and the payment bypass, since those two are the ones that get patched in one path and left open in another - Remaining findings worked in severity order, with the fix and the test that proves it documented per item - The mobile apps checked too, since backend fixes often leave the app calling an older endpoint - Final report mapping all 49 findings to verified, fixed or accepted risk I build production PHP and Node backends with authentication and payment flows, including a B2B commerce platform with 18 services live. One question: can you share the audit report so I can tell you which items are quick and which need real work before we agree scope? Martin